Re: [syndication] Syndication of javascript: urls as a security window?

[burton@openprivacy.org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julian Bond <julian_bond@voidstar.com> writes:
<snip/>

> 
> Displaying the entire description as delivered is risky. But then it's no more
> risky than visiting web sites and viewing them. If nothing else It's desirable
> to clean up the data to avoid badly coded <table>s and such like from screwing
> around with your display.

My approach would be to only escape certain elements.  We only escape <b> <i> ,
etc.  If someone puts in a <table> their presentation will look like crap.  It
should be a description not a whole html page :)

> The most annoying tag is <pre>. It does no real harm, but can make your
> display much too wide. One of the weblogs I was reading had a really wide
> piece of source code and it hung around in their RSS for much longer than my
> cache, so every couple of weeks it would turn up again. I think eventually, I
> just stopped reading that site.

can't blame you :)

Kevin

- -- 
Kevin A. Burton ( burton@apache.org, burton@openprivacy.org, burtonator@acm.org )
             Location - San Francisco, CA, Cell - 415.595.9965
        Jabber - burtonator@jabber.org,  Web - http://relativity.yi.org/

The humans won't stop there!  They'll make bigger boards with bigger nails and
so on.  Pretty soon they will make a board with a nail in it so big it will
destroy them all!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: Get my public key at: http://relativity.yi.org/pgpkey.txt

iD8DBQE8gD0wAwM6xb2dfE0RAtKRAJoDpa+7NgQs7BZi5HixOjkrzDICGACfc1uY
1To83IkdxgBaWwkWrkLBp40=
=nXi3
-----END PGP SIGNATURE-----